. Browser ID managers created before the 'HTTPOnly' feature landed didn't
  have a 'cookie_httponly' attribute.  https://bugs.launchpad.net/bugs/374816